Clear rules for data retention, access and deletion

Scope

This policy applies to records that JBA lawfully collects, generates or retains in the course of providing services or for legitimate business needs, including:

Member account information, dealer applications, business and identity verification documents, store or trading evidence, customer communications, Buyer ID administration records, bidding and successful-bid records, orders, payment and settlement evidence, invoices, delivery and import or export records, security logs, and other information necessary to provide services, protect transaction security or comply with legal obligations.

Data storage and management

JBA applies storage and access controls appropriate to the nature and sensitivity of the data.

Member application and account data is generally stored in business systems protected by access controls.

Identity documents, business evidence and other non-public review files are appropriately separated from public product images, website media and similar content, and unauthorised public access is restricted.

If JBA engages cloud, identity-verification, payment, communications or other service providers to process data, JBA applies necessary management and review according to the service, data category and applicable law.

If the processing location, service provider or processing method changes materially, JBA reassesses the relevant privacy and information-security measures as necessary.

Access permissions

JBA manages access to personal information and commercial materials according to the principle of least privilege.

Only personnel who need access for membership review, transaction processing, customer support, information security, system maintenance or legal compliance, and who have been appropriately authorised, may access the relevant information.

Access is not granted automatically merely because of a job title or general administrative privileges.

Service providers may process data only to the extent necessary to perform their entrusted functions and are subject to applicable contractual, confidentiality and security requirements.

To the extent technically and operationally feasible, JBA retains necessary records of access to, administration, export, modification and deletion of important data.

Data retention periods

JBA does not retain personal information indefinitely without a reasonable business or legal basis.

The following retention standards apply in principle:

If a law, contract or regulatory requirement specifies a longer retention period, that requirement prevails.

Deletion, anonymisation and legal holds

When a retention period expires and there is no lawful or reasonable need for continued retention, JBA deletes the data or irreversibly anonymises it by an appropriate method according to the nature of the data and system conditions.

Before deletion, JBA reasonably distinguishes membership application and identity documents from contracts, orders, invoices, accounting and transaction records that must continue to be retained by law.

Accordingly, the end of membership or a deletion request does not necessarily mean that all related transaction records can be deleted immediately.

The ordinary deletion schedule may be temporarily suspended where there is an unpaid amount, incomplete delivery, refund or claim, transaction dispute, investigation of suspected fraud or unlawful conduct, regulatory or tax requirement, judicial proceeding, or another matter requiring continued retention by law.

After the reason for the hold ends, JBA reassesses whether continued retention remains necessary.

Backups and data recovery

If JBA backs up relevant business data, it applies appropriate security measures according to the data category and risk, including access control, retention periods, recovery management and secure deletion mechanisms.

Backup data is used in principle only for business continuity, system recovery and security management, and not as a means of extending the retention period for personal information.

When backup data exceeds the applicable retention period, it is overwritten, deleted or otherwise appropriately handled under the relevant system and security rules.

Information security and operational management

To reduce the risk of unauthorised access, leakage, alteration, loss or misuse of data, JBA applies reasonable administrative and technical measures appropriate to its business scale and the nature of the data, including:

• Setting access permissions according to job responsibilities.
• Applying appropriate authentication to important systems.
• Promptly adjusting or revoking permissions when responsibilities change.
• Separating sensitive review files from public website content.
• Retaining necessary records of important data-access and administrative operations.
• Regularly reviewing data that is no longer required.
• Testing data-recovery and deletion procedures as necessary.
• Investigating suspected information-security incidents and taking necessary measures.

Access, correction and deletion requests

Under applicable law, members and applicants may request access to, correction of, suspension of use of, or deletion of relevant personal information held by JBA.

To protect personal information, JBA may require necessary identity verification before processing a request.

JBA may be unable to delete information immediately if it must continue to be retained because of law, tax or accounting obligations, an incomplete transaction, payment, claim, dispute or another legitimate reason.

In that case, JBA explains the reason for continued retention to the extent permitted by applicable law.

Submit requests to the official JBA privacy and data enquiry desk at privacy@japanbrandauction.jp with the subject “Privacy Request”. Do not attach identity documents to ordinary email; JBA will provide a secure submission method where verification documents are required.

Policy review and updates

JBA periodically reviews this policy in response to changes in laws and regulations, business processes, information systems and data-processing methods.

If a material change is made, JBA publishes the updated policy and effective date on its website and takes additional notification measures where required by applicable law.